瑞星卡卡安全论坛

本来在正常上网，但是系统速度开始变慢……
然后系统突然蓝屏！0X000008E
重新开机，弹出Explorer.exe不能为written
SREng、金山急救箱等完全卡主！严重求救！
附蓝屏dmp文件

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TheWorld)

附件: Mini012510-01.rar

可能造成本次蓝屏的驱动：XueTr0.sys
XueTr工具
以下为Dmp内容，供参考



Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [F:\Users\Lenovo\Desktop\Mini012510-01\Mini012510-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.          *
* Use .symfix to have the debugger choose a symbol path.                  *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                  *
* The Symbol Path can be set by:                                    *
*  using the _NT_SYMBOL_PATH environment variable.                *
*  using the -y <symbol_path> argument when starting the debugger. *
*  using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d8000 PsLoadedModuleList = 0x805644c0
Debug session time: Mon Jan 25 22:01:53.984 2010 (GMT+8)
System Uptime: 0 days 0:29:40.663
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                  *
* The Symbol Path can be set by:                                    *
*  using the _NT_SYMBOL_PATH environment variable.                *
*  using the -y <symbol_path> argument when starting the debugger. *
*  using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                            *
*                        Bugcheck Analysis                                    *
*                                                                            *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8056d4de, a18b1af4, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for XueTr0.sys
*** ERROR: Module load completed but symbols could not be loaded for XueTr0.sys
*** WARNING: Unable to verify timestamp for Hookport.sys
*** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
Probably caused by : XueTr0.sys ( XueTr0+3247b )
Followup: MachineOwner
---------

我的XueTr我也没动
而且那个驱动程序找不到了
还有应该无关的网速减慢、SREng不能扫描等问题:kaka3:

已经没什么大问题了
软件冲突

SREng临时扫描文件

附件: SREngLogEm.LOG

这个不是病毒 要么是驱动 要么是软件资源访问内存冲突